In a multi-tenant Cortex XSOAR deployment, an architect needs to restrict access to specific playbooks so that Tenant A analysts cannot view or execute playbooks owned by Tenant B. Where is this access control configured?
You are designing an automated phishing response workflow in Cortex XSOAR. The playbook needs to extract all URLs from an incoming email body and check their reputation using VirusTotal. Which built-in task type should you use to evaluate each URL concurrently?
An architect is designing an automated containment workflow in Cortex XDR where an endpoint must be isolated only if it is confirmed to be communicating with a known Command and Control (C2) server. Which XQL query logic accurately identifies this condition before triggering isolation?
An organization wants to measure the efficiency of its SOC by tracking how quickly analysts acknowledge incoming high-priority alerts. Which metric is being measured?
An enterprise security architect is designing high availability for Cortex XSOAR engines. If the primary engine fails, what mechanism ensures zero data loss and uninterrupted playbook execution for active incidents?
An architect is designing a multi-region threat intelligence sharing architecture using Cortex XSOAR. They need to synchronize indicators across independent regional XSOAR instances without creating circular loops. Which protocol and architecture pattern should be implemented?
An enterprise security architect is designing data residency compliance controls for Cortex XSIAM. European Union customer data must not leave the EU region. Where is data residency enforced in Cortex XSIAM?
When configuring role-based access control (RBAC) in Cortex XSOAR for an Incident Response team, which TWO permissions can be assigned to restrict unauthorized modifications? (Choose two)
An organization wants to implement the MITRE ATT&CK framework into their threat detection engineering lifecycle within Cortex XSIAM. Which specific feature enables architects to map incoming telemetry and custom correlation rules directly to ATT&CK tactics and techniques to measure coverage?
A SOC architect is integrating Cortex XSOAR with Palo Alto Networks Cortex XDR to automate the triage of high-severity alerts. Which specific architecture component should be configured to ensure seamless bi-directional incident synchronization and automated playbook execution?
An architect is configuring log ingestion for Cortex XSIAM. Which native Palo Alto Networks collector type is designed to gather syslog and CEF formatted logs from third-party security devices without requiring an external forwarder VM?
A security architect is designing an incident escalation matrix for a multinational SOC. Which metric is most critical to measure the effectiveness of the Tier 1 triage team before escalating incidents to Tier 2?
An architect is designing a threat detection architecture using Cortex XSIAM analytics. Which THREE types of data sources are critical to ingest to provide comprehensive visibility for detecting lateral movement and credential dumping? (Choose three)
An architect is configuring role-based access control (RBAC) in Cortex XSIAM for a multi-tenant SOC environment. Which TWO principles should guide the design of security analyst roles? (Choose three - wait, prompt says Which TWO for multi_select half. Let's provide TWO). Which TWO principles should guide the design of security analyst roles? (Choose two)
An organization is building a Threat Intelligence Program aligned with the Diamond Model of Intrusion Analysis. Which THREE core vertices must be analyzed for every adversary event in the incident tracking database? (Choose three)
A SOC architect is designing a threat response architecture that integrates Cortex XSOAR with various tools to automate incident response. The architect must ensure that the playbooks can dynamically decide the next steps based on the severity and type of the incident. Which TWO Cortex XSOAR features are essential for enabling conditional, context-aware automation in playbooks? (Choose two.)
An architect is designing automated threat-intelligence ingestion for a SOC. Analysts complain that the current feed floods the SIEM with low-fidelity indicators and produces excessive false positives. The architect decides to apply the Traffic Light Protocol (TLP) 2.0 markings to control sharing and handling of received intelligence. Which handling decision is consistent with TLP 2.0?
An architect is mapping a new security operations capability to the MITRE ATT&CK framework. The goal is to detect adversary behavior that occurs after initial access but before any payload is executed on a host. Which TWO ATT&CK tactic categories should the detection content prioritize? (Choose two.)
A healthcare organization is architecting its incident response capabilities using the NIST Cybersecurity Framework (CSF) 2.0. The architect must ensure that the organization can effectively respond to and recover from a ransomware incident. Which CSF 2.0 function and category combination should the architect prioritize to establish a formal incident response plan, including communication and analysis procedures?
A newly formed SOC is defining its incident response lifecycle and the CISO asks the architect to align it with the de facto international standard covering preparation, detection and analysis, containment eradication and recovery, and post-incident activity. Which reference should the architect cite as the governing framework for this lifecycle?
When designing a threat hunting methodology aligned with the MITRE ATT&CK framework, an architect wants to identify adversary persistence mechanisms. Which tactic category should the analyst focus queries on?
An architect is designing an incident response workflow in Cortex XSOAR using the Incident Spooler. Which component is primarily responsible for processing queued events into actionable incidents?
An incident response architect is defining severity levels for security alerts in Cortex XDR. Which severity classification typically triggers automated containment playbooks without human intervention?
An organization is integrating Prisma Cloud with Cortex XSOAR to automate cloud incident response. When configuring the Prisma Cloud integration instance in XSOAR, which authentication mechanism is recommended to securely fetch alerts without using static user credentials?
An enterprise security architect is integrating Cortex XSIAM with an external SIEM using the Syslog Export feature. The security team notices that certain sensitive fields need to be redacted before export. Where should the architect configure this transformation?
You are deploying Cortex XSIAM and need to ensure that endpoint logs collected from remote agents are normalized into a unified schema before analytics runs. Which feature performs this normalization?
An architect is deploying the Cortex XDR Broker VM to serve as a syslog collector for legacy network devices. The Broker VM loses connectivity to the Cortex XDR cloud. What happens to the collected syslog data during the outage?
When aligning a security operations center (SOC) with the NIST Incident Response lifecycle, which phase immediately follows 'Containment, Eradication, and Recovery'?
An architect is reviewing the Cortex XSIAM Analytics dashboard to identify root causes of security incidents. Which data visualization component aggregates related alerts into a single attack storyline?
An architect is configuring Indicator Sharing in Cortex XSOAR using the Threat Intel Management module. How are incoming STIX/TAXII indicator feeds prioritized when conflicting reputation scores are received from multiple sources?
When setting up automated email parsing in Cortex XSOAR for phishing triage, which integration is specifically required to connect to Microsoft Office 365 using modern authentication (OAuth 2.0)?
An enterprise is designing a zero-trust architecture where Cortex XDR integrates with Palo Alto Networks Next-Generation Firewalls. Which protocol and component facilitate real-time dynamic blocklisting of compromised endpoints across both the firewall and the endpoint?
An architect is designing an enterprise threat hunting program utilizing Cortex XSIAM. They want to create a custom analytics rule that triggers when a specific sequence of three distinct event types occurs within a 10-minute window on the same endpoint. Which feature should be used?
You are configuring Cortex XSOAR integration instances and need to ensure that API keys and passwords are stored securely without appearing in plaintext within playbook logs or incident data. Where should these credentials be stored?
An architect is integrating Cortex XSIAM with ServiceNow to automatically create IT service management (ITSM) tickets when incidents are promoted. Where is the field mapping between Cortex XSIAM incident fields and ServiceNow incident fields configured?
When planning an incident response table-top exercise for a Security Operations team, which framework provides a standardized taxonomy for describing adversary behaviors and tactics?
You are configuring log ingestion in Cortex XSIAM from a third-party firewall using a generic syslog collector. The logs are arriving, but the parser is failing to extract destination IP addresses correctly. What is the recommended troubleshooting step?
Which role in a well-structured Security Operations Center (SOC) is primarily responsible for performing tier-2 incident triage, deep investigation, and playbook execution?
An architect is configuring automated containment in Cortex XSOAR where analyst approval is required before isolating an executive's laptop. Which task type in the playbook accomplishes this?
When evaluating the maturity of an Incident Response program using the CMMI (Capability Maturity Model Integration) framework, what characterizes a 'Managed' (Level 2) process?
Which framework is widely recognized as a comprehensive guideline for establishing a foundational cybersecurity program through five core functions: Identify, Protect, Detect, Respond, and Recover?
An architect is designing an incident response automation strategy in Cortex XSOAR. Which TWO best practices should be followed when developing custom playbooks? (Choose two)
An architect is designing an automated threat intelligence enrichment pipeline in Cortex XSOAR. Which THREE actions are typically performed during indicator lifecycle management? (Choose three)
An enterprise security architect is configuring Cortex XSIAM data ingestion and analytics. Which THREE data sources are essential for comprehensive endpoint and cloud threat detection? (Choose three)
An organization is integrating Cortex XSIAM with third-party security tools for automated remediation. Which THREE mechanisms are supported for triggering external actions from XSIAM/XSOAR? (Choose three)
An architect is deploying Cortex XDR Broker VMs in a DMZ architecture. Which TWO network requirements must be satisfied for successful operation? (Choose two)
When designing a threat hunting architecture using XQL in Cortex XSIAM, which TWO best practices improve query performance and efficiency? (Choose two)
An architect is planning the deployment of Cortex XDR agents across a heterogeneous enterprise environment. Which TWO deployment methods are officially supported? (Choose two)
An architect is designing an enterprise incident response communication plan. Which THREE components are critical for effective operational coordination during a major security incident? (Choose three)
An enterprise security architect is reviewing threat detection coverage using the MITRE ATT&CK Navigator. Which THREE strategic objectives can be achieved using this exercise? (Choose three)
An architect is designing an automated threat hunting and containment architecture with Cortex XSIAM. Which THREE actions can be triggered automatically upon confirming a high-fidelity behavioral threat detection? (Choose three)
An architect is designing an incident response lifecycle based on the NIST SP 800-61 framework for a Security Operations Center (SOC). Which phase immediately follows the Containment, Eradication, and Recovery phase?
When designing a threat hunting architecture, an architect must differentiate between indicator-based searching and hypothesis-driven hunting. Which approach represents a hypothesis-driven threat hunt?
An architect is designing an automated containment workflow in Cortex XSOAR. The requirement is to isolate a compromised endpoint running Cortex XDR agent without disrupting critical domain controllers. Which configuration parameter must be validated in the isolation command?
An organization is adopting the Cyber Kill Chain framework to evaluate their intrusion detection capabilities across the network and endpoint layers. During which phase should security architects implement egress filtering and DNS sinkholing to disrupt adversary operations?
An architect is designing a Zero Trust Network Access (ZTNA) incident response strategy using Prisma Access. When a compromised user device is detected, which action should the automated response workflow trigger to prevent lateral movement?
A security architect is establishing an operational metrics dashboard for executive leadership. Which metric best demonstrates the risk reduction impact of automated security orchestration and response (SOAR) playbooks?
An enterprise security architect is configuring automated threat intelligence sharing between Cortex XSOAR and external ISACs using STIX/TAXII. Which component within Cortex XSOAR is primarily responsible for managing incoming threat indicators, deduplication, and indicator scoring?
An architect is designing a threat hunting architecture that leverages Cortex XSIAM XQL (XDR Query Language). To identify potential living-off-the-land binaries (LotLB) execution, which query structure correctly filters process execution events for anomalous parent-child relationships?
During a major security incident, a SOC architect needs to ensure that all evidence collected adheres to chain of custody principles. Which foundational security concept is primarily being enforced?
An architect is designing an integration between Cortex XSOAR and a third-party ticketing system (e.g., ServiceNow). The requirement is to ensure that when an incident severity is updated in XSOAR, the ticket in ServiceNow is automatically updated. Which architectural feature facilitates this synchronization?
An enterprise security architect is designing an automated threat response architecture using Cortex XSOAR. The design requires parsing unstructured phishing emails received in a dedicated mailbox. Which XSOAR capability should be leveraged to automatically extract indicators such as URLs, file hashes, and sender domains from the email body?
When designing a Security Operations Center (SOC) tiering model, what is the primary operational responsibility typically assigned to Tier 2 (Incident Responders)?
An architect is designing log retention and data tiering policies in Cortex XSIAM. To balance regulatory compliance requirements (long-term storage) with high-performance analytics (short-term fast search), how should the data architecture be structured?
When designing a Security Operations Center (SOC) using the NIST cybersecurity framework, which TWO functions are categorized under the 'Detect' core function? (Choose two)
An enterprise security architect is designing an automated containment playbook in Cortex XSOAR for ransomware attacks. Which THREE automated actions should be incorporated into the playbook to effectively contain the threat while preserving forensic evidence? (Choose three)
An architect is designing an incident response communications plan for a major data breach affecting regulated customer data. Which TWO stakeholder groups must typically be included in the formal communication escalation matrix during high-severity incidents? (Choose two)
An architect is integrating Cortex XSOAR with threat intelligence platforms. Which THREE attributes are essential when evaluating the quality and operational value of ingested threat indicators? (Choose three)
When designing an incident post-mortem (lessons learned) process following NIST guidelines, which TWO activities should the security architect mandate? (Choose two)
A SOC architect is standardizing how analysts describe adversary behavior across a multinational team. The CISO mandates adoption of the MITRE ATT&CK framework for all incident documentation. Which structural element of ATT&CK should the architect use to map a specific adversary action such as credential dumping from LSASS memory?
A multinational SOC architect is designing a threat-intelligence ingestion pipeline into Cortex XSOAR. Analysts complain that indicators from a commercial feed suppress internal detections because the feed marks legitimate corporate VPN egress IPs as malicious. The architect must add a pre-ingestion control that prevents these false positives from reaching the indicator database while retaining the feed's other indicators. Which control should be implemented?
A security architect is designing a threat response playbook in Cortex XSOAR for a large enterprise. To ensure that the playbook can automatically contain threats across the entire environment, the architect needs to integrate with the endpoint protection platform. Which integration should the architect configure to enable automated endpoint isolation and remediation actions?
A security architect at a financial services firm is designing a threat intelligence sharing program. The firm wants to automatically ingest high-fidelity indicators of compromise (IOCs) from an external partner into Cortex XSOAR to enrich alerts. The architect must select a standard that defines a structured, machine-readable format for representing cyber threat intelligence, including indicators, observed data, and relationships. Which standard should the architect choose?
An architect is building a threat-response playbook that must enrich indicators of compromise before containment decisions. The team wants to apply the Structured Threat Information Expression (STIX) 2.1 object model when exchanging indicators with partner SOCs. Which statement correctly describes how STIX 2.1 represents a malicious file hash shared between organizations?
A security architect is mapping the SOC's detection and response capabilities to the MITRE ATT&CK framework. The CISO wants to know which adversary tactic is most directly addressed by correlating endpoint process creation events with network connection events in Cortex XDR. Which ATT&CK tactic does this correlation primarily support?
A security operations architect is designing a threat intelligence-driven response architecture using Cortex XSOAR. The architect wants to automatically enrich indicators of compromise (IOCs) from multiple sources and then make a risk-based decision to block or allow them. Which component of Cortex XSOAR should be used to define the logic that correlates and scores the IOCs from different intelligence sources?
A multinational corporation is architecting a Security Operations Center (SOC) using the MITRE ATT&CK framework to prioritize detection engineering efforts. The SOC has limited resources and wants to focus on techniques that are most relevant to its industry and threat landscape. The architect must recommend a systematic approach to map existing detection rules to ATT&CK techniques and identify gaps. Which activity best accomplishes this?
An architect is aligning a new SOC's response workflow with the NIST SP 800-61 incident handling lifecycle. During the containment, eradication, and recovery phase, the team must decide which activities belong there rather than in later lessons-learned work. Which two activities are correctly performed within that phase? (Choose two.)
A SOC architect is defining the containment step in the incident response lifecycle for ransomware affecting a single endpoint. The endpoint is managed by Cortex XDR and is still communicating with its command-and-control server. Which action best satisfies immediate containment while preserving forensic evidence?
A security architect is designing a detection and response strategy using Cortex XSIAM. The architect needs to ensure that the platform can automatically correlate alerts from multiple sources and prioritize them based on severity. Which Cortex XSIAM capability should the architect leverage to achieve this?
An architect is defining severity scoring for a SOC that consumes vulnerability data from multiple scanners. Leadership wants scores that reflect exploitability in the wild rather than only theoretical severity. Which framework should the architect adopt as the primary prioritization input for this requirement?
A SOC architect is designing a threat response architecture that uses Cortex XSIAM to automate response actions across endpoint, network, and cloud domains. The CISO requires that automated actions be auditable and reversible where possible. Which TWO design elements are essential to meet these requirements? (Choose two.)
A SecOps architect is designing an automated containment workflow in Cortex XSOAR that must isolate a compromised endpoint, block the attacker's IP at the perimeter firewall, and open a ticket in the ITSM system. The containment playbook must execute these actions in parallel with a strict 15-minute SLA, and each action must produce an independent audit trail for post-incident review. Which Cortex XSOAR feature should the architect use to meet these requirements?
A security architect is designing a ransomware containment playbook in Cortex XSOAR. The playbook must automatically isolate an infected endpoint, extract its forensic artifacts, and then restore it to the production network only after a senior analyst approves. Which Cortex XSOAR task type best enforces the manual approval step before the restoration task executes?
A security operations architect is designing a threat response architecture that integrates Cortex XSOAR with various security tools. The architect must ensure that the playbooks can automatically gather enriched context from external sources and make informed decisions. Which TWO components are essential for enabling automated enrichment and decision-making in Cortex XSOAR playbooks? (Choose two.)
A SOC architect at a healthcare provider is mapping detection coverage to the MITRE ATT&CK framework using Cortex XSIAM. The CISO wants a heat map that shows which adversary techniques are covered by existing analytics and which are blind spots, using the native ATT&CK coverage view. Which prerequisite must the architect satisfy for techniques to be correctly attributed in that view?
A security architect is designing a threat response architecture that must coordinate actions across Cortex XSIAM, Cortex XSOAR, and third-party firewalls. During a recent exercise, response actions executed in the wrong order, causing an endpoint to be isolated before its indicators were enriched, which delayed the firewall block. The architect must ensure deterministic ordering of enrichment and containment steps. Which design approach best addresses this?
A security architect is designing a threat intelligence ingestion pipeline for a Cortex XSOAR deployment. The SOC receives feeds from multiple providers, but analysts complain about duplicate indicators and conflicting verdicts. The architect needs to ensure that indicators are automatically deduplicated, scored, and enriched before being used in playbooks. Which Cortex XSOAR feature should be implemented to achieve this?
A security operations architect is designing a SOC that follows the NIST Cybersecurity Framework. The architect needs to ensure that the SOC can effectively respond to incidents. According to the NIST Cybersecurity Framework, which function encompasses the activities to take action regarding a detected cybersecurity incident?
A security architect is defining the incident response lifecycle for a new SOC built on Cortex XSIAM. The CISO asks which phase of the NIST SP 800-61 lifecycle is responsible for validating that containment actions actually removed the adversary's access before returning the environment to normal operations. Which phase should the architect identify?
A multinational SOC architect is building a threat response architecture that must correlate adversary behavior across endpoint, network, and cloud telemetry. The CISO wants detections expressed in a vendor-neutral format that can be shared with an external ISAC and mapped to a common adversary taxonomy. Which framework combination should the architect adopt to satisfy both the sharing and mapping requirements?
A security architect is designing a threat response architecture using the MITRE ATT&CK framework. The SOC wants to prioritize detection engineering efforts based on the most relevant adversary techniques for their industry. The architect must ensure that the framework is used effectively to map existing detections and identify gaps. Which approach best aligns with the MITRE ATT&CK framework for this purpose?
A financial services SOC is architecting a threat response workflow in Cortex XSOAR that must query an internal threat intelligence platform, enrich indicators, and automatically create a blocklist entry only when the indicator's confidence score exceeds a defined threshold. The architect needs the playbook to evaluate the score and conditionally branch without writing custom Python. Which mechanism should be used?
A SOC architect must design a response architecture where automated playbooks can isolate endpoints, disable user accounts, and block domains without a human approving each action. Legal has mandated that every automated containment action be attributable to a named analyst, that actions be reversible, and that a full audit trail exist. Which architectural control best satisfies these requirements while preserving automation speed?
A security architect is defining the incident response lifecycle for a new SOC. The organization wants to align with the NIST SP 800-61 framework. The architect must ensure that the SOC follows the correct sequence of phases. Which of the following represents the correct order of the incident response lifecycle phases according to NIST SP 800-61?
A security architect is designing the threat intelligence ingestion pipeline for a Cortex XSOAR deployment. The organization wants to automatically block IP addresses that appear in high-confidence threat feeds, but the SOC team is concerned about false positives disrupting business-critical applications. Which capability of Cortex XSOAR should the architect configure to safely automate this response while maintaining an audit trail?
A SOC manager wants to standardize how analysts document and share threat intelligence about a newly observed malware family. The architect recommends using the Structured Threat Information Expression (STIX) format. Which statement best describes the primary purpose of STIX in a security operations architecture?
A multinational SOC architect is defining threat response requirements for Cortex XSIAM that must support both automated and analyst-driven investigations across endpoint, network, and identity telemetry. The architect must select the platform capabilities that directly enable correlation of disparate telemetry into a single incident timeline for response actions. (Choose two.)
A security operations architect is formalizing how the SOC will apply the MITRE ATT&CK framework during live incident response rather than only during retrospective reporting. Which TWO practices correctly embed ATT&CK into the active response workflow? (Choose two.)
A security operations architect is designing a threat intelligence program that follows the intelligence cycle. The architect must ensure that the program effectively supports decision-making for the SOC team. Which phase of the intelligence cycle involves defining the intelligence requirements and planning the collection of data to meet those requirements?
A multinational SOC architect is mapping detection coverage to the MITRE ATT&CK framework for a Cortex XSIAM deployment. Executive leadership wants to know which adversary techniques currently have no detection logic. Which approach should the architect take to produce this gap analysis?
A security architect is designing a threat intelligence program for a SOC. The organization wants to leverage the Cyber Kill Chain framework to structure its detection and response strategies. The architect needs to ensure that the SOC can map its existing controls to the stages of the Cyber Kill Chain. Which of the following correctly lists the stages of the Cyber Kill Chain in order?
An architect is designing a threat response workflow that must enrich indicators with multiple external intelligence sources before creating a case. The design uses Cortex XSOAR playbooks. Which approach best ensures the workflow continues even when one intelligence source is temporarily unavailable?
A SOC architect is designing the incident response workflow for a Cortex XSOAR deployment and must define how incidents move between tiers. The organization wants to ensure that low-severity phishing alerts are handled consistently without consuming senior analyst time, while high-severity malware detections receive immediate expert attention. Which design element should the architect implement to achieve this?
A multinational SOC architect is designing a metrics framework for the incident response program. Leadership wants a measure that reflects how long it takes from the moment a security event is detected to the moment the incident is fully contained. Which metric should the architect define?
A security architect is designing a threat response architecture that integrates the Diamond Model of Intrusion Analysis. The SOC wants to use the model to enrich its incident analysis and improve threat intelligence correlation. Which two of the following are core features of the Diamond Model that the architect should incorporate? (Choose two.)
A security architect is defining the containment strategy for ransomware incidents detected by Cortex XDR. The organization operates a hybrid environment with endpoints, on-premises servers, and cloud workloads. Leadership wants assurance that containment actions are applied consistently and can be reversed after eradication. Which design principle should the architect prioritize?
A SOC architect is designing the escalation path for a global follow-the-sun operation. Analysts in one region close cases at end of shift, and the next region frequently reopens them because critical context was lost during handoff. Leadership wants a design that guarantees continuity of investigative state across regions without duplicating analyst effort. Which architectural approach best addresses the root cause?
A SOC architect is designing a threat response architecture that must align with the MITRE ATT&CK framework and support automated containment. The organization wants to ensure that detection, enrichment, and response actions are consistently mapped to adversary tactics and techniques. Which TWO design practices should the architect implement to achieve this alignment? (Choose two.)
A multinational SOC architect is designing a threat response architecture based on the MITRE ATT&CK framework. The CISO wants assurance that the architecture can detect and respond to adversary techniques across all stages of an intrusion. The architect must select a primary capability that maps detections and response actions to ATT&CK techniques. Which component best fulfills this requirement?
A security operations architect is designing a threat response architecture for a new SOC. The organization wants to adopt the NIST Incident Response Lifecycle to structure their processes. The CISO asks which phase should include activities such as developing an incident response plan, establishing communication protocols, and training staff. Which phase is being described?
A SecOps architect is mapping the SOC's detection coverage to the MITRE ATT&CK Enterprise matrix. The CISO wants a defensible way to show which adversary techniques the SOC can currently detect, which it can only partially detect, and which are entirely uncovered, so remediation can be prioritized. Which approach best satisfies this requirement?
A SOC architect is designing the containment strategy for ransomware incidents detected by Cortex XSIAM. The requirement is to stop lateral spread immediately while preserving volatile evidence such as running processes and network connections on the encrypted host. Which containment action sequence best meets both goals?
A SecOps architect is establishing the incident response governance model for a new SOC. Leadership wants a framework that defines the full lifecycle from preparation through post-incident activity, with clear phases that map to measurable SOC processes and can be audited. Which framework should the architect adopt as the governing lifecycle?
A SOC architect is designing the escalation architecture for a multinational SOC that operates follow-the-sun. Analysts in one region must hand incidents to the next region without losing context, and leadership wants assurance that high-severity incidents always reach the on-call responder regardless of time zone. Which design element is most critical to meet these requirements?
A SOC architect is designing automated response playbooks in Cortex XSOAR for phishing incidents reported by users. The architecture must safely automate enrichment and containment while limiting the blast radius of a faulty or overly aggressive playbook. Which TWO design practices best achieve this? (Choose two.)